Update Havex.yar

malware/Havex.yar

@@ -69,4 +69,17 @@ rule Havex_Trojan_PHP_Server
     condition:
         all of them
 } 
+rule Havex_NetScan_Malware {
+meta:
+        description = "This rule will search for known indicators of a Havex Network Scan module infection. This module looks for hosts listening on known ICS-related ports to identify OPC or ICS systems and the file created when the scanning data is written."
+        author = "M4r14ch1"
+        date = "2015/12/21"
+        strings:
+                $s0 = "~tracedscn.yls" wide nocase //yls file created in temp directory
+                $s1 = { 2B E2 ?? }      //Measuresoft ScadaPro
+                $s2 = { 30 71 ?? }      //7-Technologies IGSS SCADA
+                $s3 = { 0A F1 2? }      //Rslinx
             
+        condition:
+                $s0 and ($s1 or $s2 or $s3)
+}